SonicWall has fixed CVE-2026-19868, an actively exploited SonicOS flaw that lets someone bypass SAML controls, including MFA, on the SSL VPN. It affects Gen7 and Gen8 firewalls with SAML login enabled. If you run one, update today to SonicOS 7.3.4-7013 or 8.2.3-8015: there is no temporary workaround.
Key facts
- CVE-2026-19868 has a CVSS score of 7.1 and affects the SonicOS SSL VPN service. You are only exposed if SAML-based login is enabled (NVD).
- Affected versions: SonicOS 7.3.3-7015 and earlier on Gen7 (TZ, NSa, NSsp and NSv) and 8.2.2-8015 and earlier on Gen8 (TZ, NSa and NSv).
- Fixed versions: SonicOS 7.3.4-7013 and 8.2.3-8015. SonicWall says there are no workarounds (SecurityWeek).
- CISA added the flaw to its Known Exploited Vulnerabilities (KEV) catalog on 6 November, with a 20 November deadline for US federal agencies (CISA).
- Advisory SNWLID-2026-0014 fixes seven vulnerabilities in total (BleepingComputer).
Am I affected if I have a SonicWall?
It depends on three things. First, the generation: the flaw affects Gen7 and Gen8 firewalls. Second, the version: SonicOS 7.3.3-7015 or earlier on Gen7, 8.2.2-8015 or earlier on Gen8. Third, the configuration: you must be using the SSL VPN with SAML login, which is the usual setup when you connect the VPN to an identity provider such as Entra ID or Okta.
If all three apply, someone with credentials from another authentication method can bypass the SAML controls, including any MFA that SAML enforces. In practice, the second factor you thought was protecting the VPN is no longer a reliable barrier. And the VPN gives access to your internal network.
If you don't use SAML on the SSL VPN, this specific CVE doesn't expose you. But the same advisory includes six other flaws, so you still need to update.
What do we know about the attacks?
Very little. SonicWall says its product team investigated a report of possible exploitation and urges customers to update as soon as possible, but it hasn't shared details of the attacks (SecurityWeek). CISA added it to KEV the same day the advisory came out (CISA), which confirms it is being exploited in the wild. The catalog states it is unknown whether it is used in ransomware campaigns (KEV catalog).
It is also unclear whether it was exploited as a zero-day, before a patch existed. That matters: if it was, a device you patch today may already have received unauthorised logins. That's why you should review the logs, not just patch.
What else does the advisory fix?
According to BleepingComputer, besides the SAML bypass there are two management interface flaws with a CVSS of 8.8 that can be exploited without authentication under certain conditions, three pre-authentication buffer overflows in SSL VPN and TACACS+ that cause denial of service, and a weak password hash in virtual appliances. The same update fixes all of them.
What to do today
- Log into the firewall and note the model, the SonicOS version and whether the SSL VPN uses SAML login.
- Update to SonicOS 7.3.4-7013 (Gen7) or 8.2.3-8015 (Gen8). There is no temporary workaround, so don't wait for the monthly maintenance window.
- Review VPN access logs for the past few weeks. Look for unusual logins, especially from accounts using another authentication method.
- If your IT provider manages the device, ask them in writing for the installed version and the patch date.
- If you see suspicious activity, change the credentials of the VPN accounts.
What it means for a small business
SonicWall is a common firewall vendor among small businesses, and many of them turned on MFA for the VPN and considered the job done. This flaw shows the limit of that idea: the firewall enforces MFA, and if the firewall has a flaw, the second factor stops protecting you. MFA is still essential. What you can't do is treat it as a substitute for patching your perimeter devices.
Our view: a firewall is internet-facing software and deserves the same urgency as a server. With a flaw in KEV and no workaround, a reasonable deadline is measured in days. CISA gives federal agencies until 20 November; your company has no reason to move more slowly.
If a third party manages the device, 'we have it under control' is not enough. Ask for the installed version and the patch date in writing, and keep the answer. If you're not sure who is accountable for your perimeter, our cybersecurity team can help you sort it out.
Frequently asked questions
If I have MFA on the VPN, am I protected?
Not if you use a Gen7 or Gen8 SonicWall with SAML login on a vulnerable version. The flaw lets someone bypass the MFA that SAML enforces. Update.
Am I affected if I don't use SAML?
Not by this CVE. But the advisory fixes six other flaws, including two in the management interface with a CVSS of 8.8, so update anyway.
Is it used in ransomware attacks?
Unknown. That is what CISA's KEV catalog states.
Sources
- SecurityWeek – SonicWall Patches Exploited SonicOS Vulnerability That Weakens VPN Logins
- BleepingComputer – SonicWall warns of new SSL-VPN MFA bypass flaw exploited in attacks
- CISA – CISA Adds One Known Exploited Vulnerability to Catalog
- CISA – Known Exploited Vulnerabilities Catalog
- NVD – CVE-2026-19868
